Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

"Catch a wave and you're sitting on top of the world." -- The Beach Boys


devel / comp.unix.solaris / Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

SubjectAuthor
* Apache 2.4 doesn't respect directory prmission rwx--x--x, listing theARZ Lab
`* Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingGary R. Schmidt
 `* Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the contenARZ Lab
  +* Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingSteffen Moser
  |`- Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingJohn D Groenveld
  `* Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingSteffen Moser
   +- Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingARZ Lab
   `* Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingARZ Lab
    `- Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listingARZ Lab

1
Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=136&group=comp.unix.solaris#136

  copy link   Newsgroups: comp.unix.solaris
X-Received: by 2002:a05:620a:248f:b0:76e:f494:ff9 with SMTP id i15-20020a05620a248f00b0076ef4940ff9mr236584qkn.4.1696866668568;
Mon, 09 Oct 2023 08:51:08 -0700 (PDT)
X-Received: by 2002:a4a:3786:0:b0:56c:86f2:ae14 with SMTP id
r128-20020a4a3786000000b0056c86f2ae14mr6214936oor.0.1696866668363; Mon, 09
Oct 2023 08:51:08 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.unix.solaris
Date: Mon, 9 Oct 2023 08:51:07 -0700 (PDT)
Injection-Info: google-groups.googlegroups.com; posting-host=213.55.225.215; posting-account=1Pu_rwoAAAB2r_mjSonZUZctDy1Suodq
NNTP-Posting-Host: 213.55.225.215
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
Subject: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the
content instead of traversing only
From: andywhyc...@gmail.com (ARZ Lab)
Injection-Date: Mon, 09 Oct 2023 15:51:08 +0000
Content-Type: text/plain; charset="UTF-8"
 by: ARZ Lab - Mon, 9 Oct 2023 15:51 UTC

Hi All,
After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
In shell as webservd user, everything works correctly - I can only traverse the directories but not list them

Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=137&group=comp.unix.solaris#137

  copy link   Newsgroups: comp.unix.solaris
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: grschm...@acm.org (Gary R. Schmidt)
Newsgroups: comp.unix.solaris
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
Date: Fri, 13 Oct 2023 23:24:11 +1100
Lines: 12
Message-ID: <cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net 87RTIkuHgvF8U+g0gaVW/wgbeOzE6zOMfoLd7r0sTn1mquZhw=
X-Orig-Path: paranoia.mcleod-schmidt.id.au!not-for-mail
Cancel-Lock: sha1:fyY01k4vROgR4eh1Vp8VSqKz7JY= sha256:Tw86EuIZPMquMDcztOGjVUmaREONNA75zN+5voP0oFU=
User-Agent: Betterbird (Windows)
Content-Language: en-AU
In-Reply-To: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
X-Clacks-Overhead: GNU Terry Pratchett
 by: Gary R. Schmidt - Fri, 13 Oct 2023 12:24 UTC

On 10/10/2023 02:51, ARZ Lab wrote:
> Hi All,
> After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
> In shell as webservd user, everything works correctly - I can only traverse the directories but not list them
>
> Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS

This has me intrigued, what are you doing with the browser and how is
your web space set up that it can see such things???

Cheers,
Gary B-)

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=138&group=comp.unix.solaris#138

  copy link   Newsgroups: comp.unix.solaris
X-Received: by 2002:a05:6214:18d3:b0:66d:32cc:3736 with SMTP id cy19-20020a05621418d300b0066d32cc3736mr45130qvb.4.1697728088024; Thu, 19 Oct 2023 08:08:08 -0700 (PDT)
X-Received: by 2002:a05:6871:42ca:b0:1e9:880f:340d with SMTP id lt10-20020a05687142ca00b001e9880f340dmr824823oab.5.1697728087771; Thu, 19 Oct 2023 08:08:07 -0700 (PDT)
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!feeder.usenetexpress.com!tr2.iad1.usenetexpress.com!69.80.99.18.MISMATCH!border-1.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.unix.solaris
Date: Thu, 19 Oct 2023 08:08:07 -0700 (PDT)
In-Reply-To: <cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>
Injection-Info: google-groups.googlegroups.com; posting-host=213.55.225.226; posting-account=1Pu_rwoAAAB2r_mjSonZUZctDy1Suodq
NNTP-Posting-Host: 213.55.225.226
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com> <cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only
From: andywhyc...@gmail.com (ARZ Lab)
Injection-Date: Thu, 19 Oct 2023 15:08:08 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Lines: 155
 by: ARZ Lab - Thu, 19 Oct 2023 15:08 UTC

On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
> On 10/10/2023 02:51, ARZ Lab wrote:
> > Hi All,
> > After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
> > In shell as webservd user, everything works correctly - I can only traverse the directories but not list them
> >
> > Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
> This has me intrigued, what are you doing with the browser and how is
> your web space set up that it can see such things???
>
> Cheers,
> Gary B-)

Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
I made a simple and clean demo, the prod server behaves the same way

root@inet:/# zoneadm list -iv
ID NAME STATUS PATH BRAND IP
3 inet running / solaris shared

root@inet:/# uname -a
SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone

I'm running in NGZ, allright

From /var/apache2/2.4/conf/httpd.conf:

User webservd
DocumentRoot "/var/apache2/2.4/htdocs"

oot@inet:/# ps -ef | grep http
webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http

Now watch my fingers!

root@inet:/# find /var/apache2/2.4/htdocs -ls
8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
root@inet:/#
root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
haha

Yeah, root can of course

root@inet:/#
root@inet:/# su - webservd
webservd@inet:~$
webservd@inet:~$
webservd@inet:~$ id -a
uid=80(webservd) gid=80(webservd) groups=80(webservd)
webservd@inet:~$
webservd@inet:~$
webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
/var/apache2/2.4/htdocs: Permission denied
total 17
webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
/var/apache2/2.4/htdocs/a: Permission denied
total 17
webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
total 17
d--------- 3 root root 3 Oct 9 10:49 c

All as expected so far...

webservd@inet:~$
webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt
/var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied

And this too. But then...

webservd@inet:~$
webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
haha
webservd@inet:~$

What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?

Pleeease don't tell me I must use Linux ))

Thanks for reading this, I hope you are having fun, too ))
It's not a joke, honestly!

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<uhetso$o7gi$1@solani.org>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=139&group=comp.unix.solaris#139

  copy link   Newsgroups: comp.unix.solaris
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: use...@steffen-moser.de (Steffen Moser)
Newsgroups: comp.unix.solaris
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
Date: Fri, 27 Oct 2023 01:48:40 +0200
Message-ID: <uhetso$o7gi$1@solani.org>
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>
<15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Thu, 26 Oct 2023 23:48:40 -0000 (UTC)
Injection-Info: solani.org;
logging-data="794130"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:XoVkebWzGqG3S4gd0O50FC7+588=
In-Reply-To: <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
X-User-ID: eJwNy8ENADEIA7CVSpNAGYeiY/8Rrl9LFty8gy6nRrORqm19xd2PGKpTLNzCIRIYMiMYb023W8/tzLSVn63zAywuFII=
Content-Language: de-DE
 by: Steffen Moser - Thu, 26 Oct 2023 23:48 UTC

Hi,

very strange. Cannot reproduce it on Solaris 11.4 SRU 62, x86-64,
non-global zone. Will try on SRU 42. What I find strange at a first
glance is that you seem to have Apache's config file sitting in

/var/apache2/2.4/conf/httpd.conf

on a "simple and clean demo". AFAIK, the default place of Apache 2.4's
config on Solaris 11.4 should be

/etc/apache2/2.4/...

I don't have a "conf" subdirectory in "/var/apache/2.4" at all.

Maybe "truss" gives you some more insight how Apache is capable to
access the directory and the document within the structure?

Kind regards,
Steffen

On 19.10.23 17:08, ARZ Lab wrote:
> On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
>> On 10/10/2023 02:51, ARZ Lab wrote:
>> > Hi All,
>> > After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
>> > In shell as webservd user, everything works correctly - I can only traverse the directories but not list them
>> >
>> > Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
>> This has me intrigued, what are you doing with the browser and how is
>> your web space set up that it can see such things???
>>
>> Cheers,
>> Gary B-)
>
> Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
> It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
> I made a simple and clean demo, the prod server behaves the same way
>
> root@inet:/# zoneadm list -iv
> ID NAME STATUS PATH BRAND IP
> 3 inet running / solaris shared
>
> root@inet:/# uname -a
> SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone
>
> I'm running in NGZ, allright
>
> From /var/apache2/2.4/conf/httpd.conf:
>
> User webservd
> DocumentRoot "/var/apache2/2.4/htdocs"
>
> oot@inet:/# ps -ef | grep http
> webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
> webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
> webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
> webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
> webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
> webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
> webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http
>
>
> Now watch my fingers!
>
> root@inet:/# find /var/apache2/2.4/htdocs -ls
> 8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
> 8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
> 8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
> 8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
> 8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
> 8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
> root@inet:/#
> root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
> haha
>
> Yeah, root can of course
>
> root@inet:/#
> root@inet:/# su - webservd
> webservd@inet:~$
> webservd@inet:~$
> webservd@inet:~$ id -a
> uid=80(webservd) gid=80(webservd) groups=80(webservd)
> webservd@inet:~$
> webservd@inet:~$
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
> /var/apache2/2.4/htdocs: Permission denied
> total 17
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
> /var/apache2/2.4/htdocs/a: Permission denied
> total 17
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
> total 17
> d--------- 3 root root 3 Oct 9 10:49 c
>
> All as expected so far...
>
> webservd@inet:~$
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt
> /var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied
>
> And this too. But then...
>
> webservd@inet:~$
> webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
> haha
> webservd@inet:~$
>
> What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?
>
> Pleeease don't tell me I must use Linux ))
>
> Thanks for reading this, I hope you are having fun, too ))
> It's not a joke, honestly!

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<7aO_M.147466$sxoa.127538@fx13.iad>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=140&group=comp.unix.solaris#140

  copy link   Newsgroups: comp.unix.solaris
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!feeder1.feed.usenet.farm!feed.usenet.farm!peer02.ams4!peer.am4.highwinds-media.com!peer01.iad!feed-me.highwinds-media.com!news.highwinds-media.com!fx13.iad.POSTED!not-for-mail
From: groenv...@acm.org (John D Groenveld)
Newsgroups: comp.unix.solaris
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com> <cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au> <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com> <uhetso$o7gi$1@solani.org>
Organization: Groenveld.US
Lines: 24
Message-ID: <7aO_M.147466$sxoa.127538@fx13.iad>
X-Complaints-To: abuse@frugalusenet.com
NNTP-Posting-Date: Fri, 27 Oct 2023 12:37:23 UTC
Date: Fri, 27 Oct 2023 12:37:23 GMT
X-Received-Bytes: 1676
 by: John D Groenveld - Fri, 27 Oct 2023 12:37 UTC

In article <uhetso$o7gi$1@solani.org>,
Steffen Moser <usenet@steffen-moser.de> wrote:
>very strange. Cannot reproduce it on Solaris 11.4 SRU 62, x86-64,
>non-global zone. Will try on SRU 42. What I find strange at a first
>glance is that you seem to have Apache's config file sitting in
>
> /var/apache2/2.4/conf/httpd.conf
>
>on a "simple and clean demo". AFAIK, the default place of Apache 2.4's
>config on Solaris 11.4 should be
>
> /etc/apache2/2.4/...
>
>I don't have a "conf" subdirectory in "/var/apache/2.4" at all.

The manifest for pkg://solaris/web/server/apache-24 is here:
<URL:http://pkg.oracle.com/solaris/release/manifest/0/web%2Fserver%2Fapache-24@2.4.51%2C11.4-11.4.42.0.0.111.0%3A20211203T212052Z>

Best practice is possibly to drop your customizations into a single
application.conf in /etc/apache2/2.4/conf.d which automagically gets
included

John
groenveld@acm.org

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<uhtjo6$rc0v$1@solani.org>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=142&group=comp.unix.solaris#142

  copy link   Newsgroups: comp.unix.solaris
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: use...@steffen-moser.de (Steffen Moser)
Newsgroups: comp.unix.solaris
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
Date: Wed, 1 Nov 2023 14:27:34 +0100
Message-ID: <uhtjo6$rc0v$1@solani.org>
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au>
<15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Wed, 1 Nov 2023 13:27:34 -0000 (UTC)
Injection-Info: solani.org;
logging-data="897055"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:oSoTRzprGkSODVgLjYV7MrR/J/E=
Content-Language: de-DE
X-User-ID: eJwNy9sBADEEBMCWPIIoR7D9l3A3/2Pq7B3HzY/BsNinl0qMfbhGS6AipH5KtObSEq8ld7+MXCSKEOPcf6X9AF0CFj4=
In-Reply-To: <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
 by: Steffen Moser - Wed, 1 Nov 2023 13:27 UTC

Hi again,

tried to reproduce it on Solaris 11.4.42.111.0, but cannot:

curl http://localhost/a/b/c/d/e.txt

gives me Apache's permission denied output - as expected.

The only difference is the position of the httpd.conf file. In a plain
installation of Solaris 11.4 CBE, I don't find a

/var/apache2/2.4/conf/

directory.

Kind regards,
Steffen

On 19.10.23 17:08, ARZ Lab wrote:
> On Friday, October 13, 2023 at 2:29:10 PM UTC+2, Gary R. Schmidt wrote:
>> On 10/10/2023 02:51, ARZ Lab wrote:
>> > Hi All,
>> > After upgrade Solaris 11.1 to 11.4 with replacement of Apache 2.2 by 2.4, the browser happity shows the directories with filesystem permission 711 owned *not* by webservd
>> > In shell as webservd user, everything works correctly - I can only traverse the directories but not list them
>> >
>> > Puzzle... I'm sure apache runs as webservd... Filesystem is native Solaris 11.4 ZFS
>> This has me intrigued, what are you doing with the browser and how is
>> your web space set up that it can see such things???
>>
>> Cheers,
>> Gary B-)
>
> Hello Gary, I'm intrigued, too! Can't crack it despite 30-years marriage with UNIX ))
> It used to work just fine with Apache 2.2 in Solaris 11.1, but changed after upgrade to 11.4 and 2.4...
> I made a simple and clean demo, the prod server behaves the same way
>
> root@inet:/# zoneadm list -iv
> ID NAME STATUS PATH BRAND IP
> 3 inet running / solaris shared
>
> root@inet:/# uname -a
> SunOS inet 5.11 11.4.42.111.0 i86pc i386 i86pc non-global-zone
>
> I'm running in NGZ, allright
>
> From /var/apache2/2.4/conf/httpd.conf:
>
> User webservd
> DocumentRoot "/var/apache2/2.4/htdocs"
>
> oot@inet:/# ps -ef | grep http
> webservd 15790 15789 0 Oct 09 ? 0:00 /usr/apache2/2.4/bin/httpd -k start
> webservd 15793 15789 0 Oct 09 ? 0:06 /usr/apache2/2.4/bin/httpd -k start
> webservd 15809 15789 0 Oct 09 ? 0:27 /usr/apache2/2.4/bin/httpd -k start
> webservd 15791 15789 0 Oct 09 ? 0:03 /usr/apache2/2.4/bin/httpd -k start
> webservd 15789 1308 0 Oct 09 ? 0:20 /usr/apache2/2.4/bin/httpd -k start
> webservd 15792 15789 0 Oct 09 ? 0:02 /usr/apache2/2.4/bin/httpd -k start
> webservd 15719 15694 0 16:39:02 pts/10 0:00 grep http
>
>
> Now watch my fingers!
>
> root@inet:/# find /var/apache2/2.4/htdocs -ls
> 8200 9 drwx--x--x 4 root root 4 Oct 17 18:24 /var/apache2/2.4/htdocs
> 8206 9 drwx--x--x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a ##### despite unreadable parent directories...
> 8207 9 drwxr-xr-x 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b ##### webservd should be able to reach this directory AND read content
> 8208 9 d--------- 3 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c
> 8209 9 drwx--x--x 2 root root 3 Oct 9 10:49 /var/apache2/2.4/htdocs/a/b/c/d
> 8213 5 -rw-r--r-- 1 root root 5 Oct 9 10:16 /var/apache2/2.4/htdocs/a/b/c/d/e.txt ##### but should have no way to reach here!
> root@inet:/#
> root@inet:/# cat /var/apache2/2.4/htdocs/a/b/c/d/e.txt
> haha
>
> Yeah, root can of course
>
> root@inet:/#
> root@inet:/# su - webservd
> webservd@inet:~$
> webservd@inet:~$
> webservd@inet:~$ id -a
> uid=80(webservd) gid=80(webservd) groups=80(webservd)
> webservd@inet:~$
> webservd@inet:~$
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs
> /var/apache2/2.4/htdocs: Permission denied
> total 17
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a
> /var/apache2/2.4/htdocs/a: Permission denied
> total 17
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b
> total 17
> d--------- 3 root root 3 Oct 9 10:49 c
>
> All as expected so far...
>
> webservd@inet:~$
> webservd@inet:~$ ls -l /var/apache2/2.4/htdocs/a/b/c/d/e.txt
> /var/apache2/2.4/htdocs/a/b/c/d/e.txt: Permission denied
>
> And this too. But then...
>
> webservd@inet:~$
> webservd@inet:~$ curl http://localhost/a/b/c/d/e.txt
> haha
> webservd@inet:~$
>
> What's going on with Apache? It can read *anything*, just like root! Even though running as webservd... Or isn't?
>
> Pleeease don't tell me I must use Linux ))
>
> Thanks for reading this, I hope you are having fun, too ))
> It's not a joke, honestly!

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<90cffcdb-b6ad-4a40-9b67-44a6c6d9e945n@googlegroups.com>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=155&group=comp.unix.solaris#155

  copy link   Newsgroups: comp.unix.solaris
X-Received: by 2002:a05:622a:1894:b0:423:821b:b66f with SMTP id v20-20020a05622a189400b00423821bb66fmr855693qtc.13.1701452048013;
Fri, 01 Dec 2023 09:34:08 -0800 (PST)
X-Received: by 2002:a25:8b90:0:b0:db4:6936:48b7 with SMTP id
j16-20020a258b90000000b00db4693648b7mr885555ybl.2.1701452047699; Fri, 01 Dec
2023 09:34:07 -0800 (PST)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!border-2.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.unix.solaris
Date: Fri, 1 Dec 2023 09:34:07 -0800 (PST)
In-Reply-To: <uhtjo6$rc0v$1@solani.org>
Injection-Info: google-groups.googlegroups.com; posting-host=213.55.224.118; posting-account=1Pu_rwoAAAB2r_mjSonZUZctDy1Suodq
NNTP-Posting-Host: 213.55.224.118
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au> <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
<uhtjo6$rc0v$1@solani.org>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <90cffcdb-b6ad-4a40-9b67-44a6c6d9e945n@googlegroups.com>
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
From: andywhyc...@gmail.com (ARZ Lab)
Injection-Date: Fri, 01 Dec 2023 17:34:08 +0000
Content-Type: text/plain; charset="UTF-8"
Lines: 37
 by: ARZ Lab - Fri, 1 Dec 2023 17:34 UTC

Many thanks for the suggestions, it helped to find a veird intermediate solution, but still not the root cause.
Looks like the problem is in loopback mount between GZ and NGZ.
On this server, the data under DocumentRoot must be used by several NGZs (running SMTP, Samba, Apache) , therefore are placed on a large zpool with intentionally confusing name "junk" ))
Zones mount it as follows (extract from /etc/zones/inet.xml, for example)

<filesystem special="/junk/apache" directory="/junk/apache" type="lofs">
<fsoption name="rw"/>
<fsoption name="nodevices"/>
</filesystem>

This results in following mount (see the 2nd line, the 1st line is a default mounted /var mount for comparison)

mount | egrep 'inet.*var on|inet.*apac'
/junk/zones/inet/root/var on junk/zones/inet/rpool/ROOT/11.4.42.111.1/var read/write/setuid/nodevices/rstchown/nonbmand/exec/xattr/atime/mountpoint=/junk/zones/inet/root/var/zone=inet/nozonemod/sharezone=10/dev=3990091 on Fri Dec 1 15:05:10 2023
/junk/zones/inet/root/junk/apache on /junk/apache read/write/setuid/nodevices/rstchown/zone=inet/nozonemod/sharezone=10/dev=3990010 on Fri Dec 1 15:05:10 2023

DocumentRoot in httpd.conf can be the default /var/apache2/2.4/htdocs, and pointed to with stmlinks, or modified to /junk/apache/htdocs - this doesn't make any difference

# grep ^DocumentRoot /junk/apache/httpd.conf*
/junk/apache/httpd.conf:DocumentRoot "/junk/apache/htdocs"
/junk/apache/httpd.conf_WithLinks:DocumentRoot "/var/apache2/2.4/htdocs"

it doesn't matter, Apache still does't respect filesystem ownership/permissions in both cases, unlike bash.
However, as soon as I give up on loopback mount and put the http content under real /var, permissions/ownership are respected by Apache.

I tried to play with various mount options in loopback mount, no luck.
I can't keep htdocs on "inet" zone's own /var directory (actually also mounted, but as own dataset via ZFS, not LOFS) because I need to read/write this directory from multiple NGZs, and that's only possible with LOFS to globally mouted ZFS

If I mount the Apache home as ZFS (legacy or via set mountpoint),

zfs set mountpoint=/junk/zones/inet/root/junk/apache junk/apache
or
zfs set mountpoint=legacy && mount -F zfs junk/apache /junk/zones/inet/root/junk/apache

again, everything works like a charm, but this way I can have one mountpoint only, unlike with LOFS.
Looks like something has changed in OS/ZFS from Solaris 11.1 to 11.4, or in Apache from 2.2 to 2.4. The latter sounds more probably, as bash still respects the filesystem permission on LOFS-mounted filesystem

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<707773bd-fe0f-45a4-a4ed-7ee644ad6e53n@googlegroups.com>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=156&group=comp.unix.solaris#156

  copy link   Newsgroups: comp.unix.solaris
X-Received: by 2002:a05:622a:17ca:b0:423:733f:bec8 with SMTP id u10-20020a05622a17ca00b00423733fbec8mr887450qtk.9.1701461387031;
Fri, 01 Dec 2023 12:09:47 -0800 (PST)
X-Received: by 2002:a17:903:44f:b0:1cf:e113:790b with SMTP id
iw15-20020a170903044f00b001cfe113790bmr2511305plb.11.1701461386515; Fri, 01
Dec 2023 12:09:46 -0800 (PST)
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!peer01.iad!feed-me.highwinds-media.com!news.highwinds-media.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.unix.solaris
Date: Fri, 1 Dec 2023 12:09:45 -0800 (PST)
In-Reply-To: <uhtjo6$rc0v$1@solani.org>
Injection-Info: google-groups.googlegroups.com; posting-host=213.55.224.118; posting-account=1Pu_rwoAAAB2r_mjSonZUZctDy1Suodq
NNTP-Posting-Host: 213.55.224.118
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au> <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
<uhtjo6$rc0v$1@solani.org>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <707773bd-fe0f-45a4-a4ed-7ee644ad6e53n@googlegroups.com>
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
From: andywhyc...@gmail.com (ARZ Lab)
Injection-Date: Fri, 01 Dec 2023 20:09:47 +0000
Content-Type: text/plain; charset="UTF-8"
X-Received-Bytes: 3927
 by: ARZ Lab - Fri, 1 Dec 2023 20:09 UTC

Many thanks for the suggestions, it helped to find a weird intermediate solution, but still not the root cause.
Looks like the problem is in loopback mount between GZ and NGZ.
On this server, the data under DocumentRoot must be used by several NGZs (running SMTP, Samba, Apache) , therefore are placed on a large zpool with intentionally confusing name "junk" ))
Zones mount it as follows (extract from /etc/zones/inet.xml, for example)

<filesystem special="/junk/apache" directory="/junk/apache" type="lofs">
<fsoption name="rw"/>
<fsoption name="nodevices"/>
</filesystem>

This results in following mount (see the 2nd line, the 1st line is a default mounted /var mount for comparison)

mount | egrep 'inet.*var on|inet.*apac'
/junk/zones/inet/root/var on junk/zones/inet/rpool/ROOT/11.4.42.111.1/var read/write/setuid/nodevices/rstchown/nonbmand/exec/xattr/atime/mountpoint=/junk/zones/inet/root/var/zone=inet/nozonemod/sharezone=10/dev=3990091 on Fri Dec 1 15:05:10 2023
/junk/zones/inet/root/junk/apache on /junk/apache read/write/setuid/nodevices/rstchown/zone=inet/nozonemod/sharezone=10/dev=3990010 on Fri Dec 1 15:05:10 2023

DocumentRoot in httpd.conf can be the default /var/apache2/2.4/htdocs, and pointed to with stmlinks, or modified to /junk/apache/htdocs - this doesn't make any difference

# grep ^DocumentRoot /junk/apache/httpd.conf*
/junk/apache/httpd.conf:DocumentRoot "/junk/apache/htdocs"
/junk/apache/httpd.conf_WithLinks:DocumentRoot "/var/apache2/2.4/htdocs"

it doesn't matter, Apache still does't respect filesystem ownership/permissions in both cases, unlike bash.
However, as soon as I give up on loopback mount and put the http content under real /var, permissions/ownership are respected by Apache.

I tried to play with various mount options in loopback mount, no luck.
I can't keep htdocs on "inet" zone's own /var directory (actually also mounted, but as own dataset via ZFS, not LOFS) because I need to read/write this directory from multiple NGZs, and that's only possible with LOFS to globally mouted ZFS

If I mount the Apache home as ZFS (legacy or via set mountpoint),

zfs set mountpoint=/junk/zones/inet/root/junk/apache junk/apache
or
zfs set mountpoint=legacy && mount -F zfs junk/apache /junk/zones/inet/root/junk/apache

again, everything works like a charm, but this way I can have one mountpoint only, unlike with LOFS.
Looks like something has changed in OS/ZFS from Solaris 11.1 to 11.4, or in Apache from 2.2 to 2.4. The latter sounds more probably, as bash still respects the filesystem permission on LOFS-mounted filesystem

Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

<8a66c313-4e07-47f1-8b0d-f759687c7c1dn@googlegroups.com>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=157&group=comp.unix.solaris#157

  copy link   Newsgroups: comp.unix.solaris
X-Received: by 2002:a0c:e70d:0:b0:67a:b289:d6ef with SMTP id d13-20020a0ce70d000000b0067ab289d6efmr34946qvn.0.1701966223059;
Thu, 07 Dec 2023 08:23:43 -0800 (PST)
X-Received: by 2002:a05:6870:2213:b0:1fa:e787:d416 with SMTP id
i19-20020a056870221300b001fae787d416mr3389149oaf.3.1701966222767; Thu, 07 Dec
2023 08:23:42 -0800 (PST)
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!peer02.iad!feed-me.highwinds-media.com!news.highwinds-media.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.unix.solaris
Date: Thu, 7 Dec 2023 08:23:42 -0800 (PST)
In-Reply-To: <707773bd-fe0f-45a4-a4ed-7ee644ad6e53n@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=213.55.225.118; posting-account=1Pu_rwoAAAB2r_mjSonZUZctDy1Suodq
NNTP-Posting-Host: 213.55.225.118
References: <99ac5f84-b942-499f-9e4f-1b1136a5fce9n@googlegroups.com>
<cgpnvj-7t6.ln1@paranoia.mcleod-schmidt.id.au> <15a0b7db-bf05-475c-953b-379cff517335n@googlegroups.com>
<uhtjo6$rc0v$1@solani.org> <707773bd-fe0f-45a4-a4ed-7ee644ad6e53n@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <8a66c313-4e07-47f1-8b0d-f759687c7c1dn@googlegroups.com>
Subject: Re: Apache 2.4 doesn't respect directory prmission rwx--x--x, listing
the content instead of traversing only
From: andywhyc...@gmail.com (ARZ Lab)
Injection-Date: Thu, 07 Dec 2023 16:23:43 +0000
Content-Type: text/plain; charset="UTF-8"
X-Received-Bytes: 3972
 by: ARZ Lab - Thu, 7 Dec 2023 16:23 UTC

I've done fresh installation of Solaris 11.3 an d 11.4.42 as follows
Interactively Install from USB text install
Create and install NGZ "inet" with following loopbackmounts:
cat /etc/zones/inet.xml | tidy -xml -q | grep filesystem
<filesystem special="/junk/export/www" directory="/export/www" </filesystem>

boot it
zlogin inet
pkg exact-install solaris-minimal-server # reduced to minimal footprint
pkg install apache-24
Created the funny dir there to test

root@inet:# find /var/apache2/2.4/htdocs/a -ls
7521 9 drwx--x--x 3 root root 3 Dec 7 14:02 /var/apache2/2.4/htdocs/a
7522 9 drwxr-xr-x 3 root root 3 Dec 7 14:02 /var/apache2/2.4/htdocs/a/b
7523 9 d--------- 3 root root 3 Dec 7 14:02 /var/apache2/2.4/htdocs/a/b/c
7524 9 drwx--x--x 2 root root 3 Dec 7 14:02 /var/apache2/2.4/htdocs/a/b/c/d
7525 5 -rw-r--r-- 1 root root 5 Dec 7 14:02 /var/apache2/2.4/htdocs/a/b/c/d/e.txt

It works as expected in both 11.3, 11.4, unless htdocs moved to the looppack-mounted filesystem:

root@inet:/var/apache2/2.4# df -h /var/apache2/2.4/htdocs/a/.
Filesystem Size Used Available Capacity Mounted on
rpool/ROOT/11.4.42.111.1/var
1.78T 90.6M 1.78T 1% /var

mkdir /export/www/htdocs
cd /var/apache2/2.4/htdocs
find . cpio -dump /export/www/.
cd ..
mv htdocs htdocs.local
ln -s /export/www/htdocs .

root@inet:/var/apache2/2.4# ls -al
total 137
drwxr-xr-x 8 root sys 9 Dec 7 14:56 .
drwxr-xr-x 3 root sys 3 Dec 7 13:58 ..
drwxr-xr-x 2 root sys 6 Dec 7 13:58 cgi-bin
drwxr-xr-x 3 root sys 22 Dec 7 13:58 error
lrwxrwxrwx 1 root root 18 Dec 7 14:17 htdocs -> /export/www/htdocs
drwxr-xr-x 3 root sys 4 Dec 7 14:02 htdocs.local
drwxr-xr-x 3 root sys 179 Dec 7 13:58 icons
drwx------ 2 webservd webservd 4 Dec 7 13:59 logs
drwxr-xr-x 2 webservd webservd 2 Dec 7 13:58 proxy

root@inet:/var/apache2/2.4# df -h /var/apache2/2.4/htdocs/a/.
Filesystem Size Used Available Capacity Mounted on
/export/www 1.78T 216K 1.78T 1% /export/www

svcadm apache24 restart

Now, it works correctly in 11.3 (apache respects files/dirs ownershop/permissions).
And in 11.4, apache just ignores all these permissions and reads anything under htdocs, even though all httpd processes run as webservd user.


devel / comp.unix.solaris / Apache 2.4 doesn't respect directory prmission rwx--x--x, listing the content instead of traversing only

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor